索福斯削减威胁调查时间96%与OpenAI日间休息
与OpenAI Daybreak一起，索福斯将边境情报与网络安全专业知识相结合，以更快地调查威胁并大规模保护客户。
89秒钟
使用AI agents处理案件的平均答复时间
96%
使用OpenAI模型缩短调查时间
52%
大赦国际解决的MDR案件
Frontier AI正在两侧改变网络安全(在新窗口打开). 先进的模型可以帮助维权者更快地发现和调查威胁。 但这些能力也正在向开放型模式扩展，为攻击者发现脆弱性和加速开发提供了新的途径。
Sophos(在新窗口开放)是阻碍其前进的公司之一，它保护了625 000多个跨部门和跨区域组织。 称 John Peterson，公司首席技术官。 “40年来，我们在网络安全事业中培养了与这些现象作斗争的丰富专业知识。 ”
通过OpenAI Daybreak，索福斯将OpenAI模型与自己的威胁情报，反应游戏本和安全专业知识相结合。 目标不仅仅是给分析家另一个工具。 让索福斯的专长在它所保护的每一个客户身上产生更大的影响。
“Sophos 带来关于大规模打击攻击的专长和专门技能。 诸如Daybreak和OpenAI等公司等方案带来了前沿情报，使我们能够利用这一领域的专门知识，并扩大其规模，支持我们所有的客户。”
作品的核心是Sophos Fusion，即包括Sophos管理检测和反应(MDR)在内的Sophos AI-native网络防御系统。 带来与Sophos自己的产品一起，这些传感器共同每天产生数万亿事件，Sophos将其蒸馏成大约1 000至2 000个案件，供其9个安全行动中心调查。
通过 " 黎明 " 建造的Agents改变了处理这些案件的方式。 agent调查收集每个案件的客户背景，发现，妥协指标(IoCs)和相关的威胁情报。 然后，规划模式产生了一个计划-执行-审查循环：制定调查计划，完成步骤，并编写一份摘要，其中包含建议的反应行动，供分析人员审查。 其他agents可以执行部分反应。
在 " 黎明 " 之前，调查和应对案件主要取决于人的专门知识。 Sophos的现有流程平均在38分钟左右——性能彼得森称优于96%的专业安保业务中心。
使用agents的病例平均反应时间已降至约89秒。 大约一半我们处理的案件现在由agents自动处理，我们使用“黎明”模型开发。”
索福斯通过三种操作模式将客户控制建设到其MDR服务中：
- 通知：Sophos调查案件，建议答复，但客户采取行动。
- 协作：索福斯和客户在采取行动前合作。
- 授权：Sophos可以直接代表客户作出回应。
无论工作是由一个人完成还是agent完成，都适用同样的界限。 索福斯使用自动化来快速移动并更好地利用分析师的时间，但潜在的破坏性行动仍然需要适当的人监督。
agent的处理令我们感到不舒服
- 将使用agents的病例的平均反应时间从大约38分钟减少到89秒。
- 允许索福斯在索福斯分析师校准的边界内，用AI最终解决52%的MDR病例。
- 给予客户更快更一致的调查经验。
- 帮助Sophos规模计算，而不是依赖稀缺的网络安全人口数的同等增长。
- 使分析人员重新关注其专门知识最为重要的威胁、例外和决定。
彼得森·称(英语：索福斯会不断扩展它的agents所能做的。 “反应能力将继续变得更加精细，我们将用我们建造的agents来扩大使用范围。
“通过诸如“日出”之类的方案，我们有机会比攻击者群体更进一步。”
他向其他安全领导人提出的建议很简单：“安全领导人明天应该做的一件事是，真正回到关注他们组织的安全基本面上来。” “这当然包括补丁。 但补丁只会包括供应商知道的脆弱性。”
答案是维持“分层安全方法”，包括端点保护、多要素认证、网络分割和强有力的安全行动。 “人们正在以惊人的速度发现脆弱性，因此，我认为今天做好基本内容比以往更重要。
本文由 AI图鉴自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Sophos cuts threat investigation time by 96% with OpenAI Daybreak
With OpenAI Daybreak, Sophos combines frontier intelligence with cybersecurity expertise to investigate threats faster and protect customers at scale.
89 seconds
average response time for cases using AI agents
96%
reduction in investigation time using OpenAI models
52%
of MDR cases resolved end-to-end by AI
Frontier AI is changing cybersecurity on both sides(opens in a new window). Advanced models can help defenders find and investigate threats faster. But those capabilities are also spreading to open-weight models, giving attackers new ways to discover vulnerabilities and accelerate exploitation.
Sophos(opens in a new window) is one of the companies standing in their way, protecting more than 625,000 organisations across sectors and regions. “We see a huge variety of different attacks,” says John Peterson, the company’s Chief Technology Officer. “We’ve cultivated vast expertise in combating them over four decades in the cybersecurity business.”
Through OpenAI Daybreak, Sophos is combining OpenAI models with its own threat intelligence, response playbooks and security expertise. The aim isn’t simply to give analysts another tool. It’s to increase the impact of Sophos’s expertise across every customer it protects.
“Sophos brings the domain expertise and the know-how to combat attacks at scale. Programmes like Daybreak, and companies like OpenAI, bring frontier intelligence that allows us to take that domain expertise and scale it to support all of our customers.”
At the centre of the work is Sophos Fusion, the Sophos AI-native cyber defense system that includes Sophos Managed Detection and Response (MDR). It brings together sensor data from more than 500 third-party integrations alongside Sophos’s own products. Together, those sensors generate trillions of events every day, which Sophos distills into roughly 1,000 to 2,000 cases for its nine security operations centres to investigate.
Agents built through Daybreak have changed how those cases are handled. An investigation agent gathers the customer context, detections, indicators of compromise (IoCs) and relevant threat intelligence for each case. A planning model then creates a plan–execute–review loop: building an investigation plan, completing the steps and producing a summary with recommended response actions for analysts to review. Other agents can carry out parts of the response.
Before Daybreak, investigating and responding to a case depended primarily on human expertise. Sophos’s existing process averaged around 38 minutes — performance Peterson says was better than 96% of professional security operations centres.
“Now, because of the agents we’ve been able to build through the Daybreak programme, the average response time for cases using those agents has fallen to about 89 seconds. About half of the cases we handle are now being automated by agents we developed using the Daybreak models.”
Sophos has built customer control into its MDR service through three operating modes:
- Notify: Sophos investigates the case and recommends a response, but the customer acts.
- Collaborate: Sophos and the customer work together before action is taken.
- Authorise: Sophos can respond directly on the customer’s behalf.
The same boundaries apply whether work is completed by a person or an agent. Sophos uses automation to move quickly and make better use of analysts’ time, but potentially destructive actions still require the right level of human oversight.
“Anything we don’t feel comfortable with an agent handling gets passed off for human judgement,” Peterson confirms.
- Reduced the average response time for cases using agents from approximately 38 minutes to 89 seconds.
- Enabled Sophos to resolve 52% of MDR cases end-to-end with AI, within boundaries calibrated by Sophos analysts.
- Gives customers a faster and more consistent investigation experience.
- Helps Sophos scale compute rather than relying on equivalent growth in scarce cybersecurity headcount.
- Returns analysts’ attention to the threats, exceptions and decisions where their expertise matters most.
Peterson says Sophos will keep expanding what its agents can do. “The response capabilities are going to continue to become more sophisticated, and we’re going to broaden the range of use cases we address with the agents we’ve built.”
“With programmes like Daybreak, we have an opportunity to stay a step ahead of the attacker community.”
His advice for other security leaders is simple: “The one thing security leaders should do tomorrow is really come back to focusing on the security fundamentals for their organization,” he says. “That of course includes patching. But patches are only ever going to include vulnerabilities that are known by the vendor.”
The answer is to maintain “a layered security approach” that includes endpoint protection, multifactor authentication (MFA), network segmentation and strong security operations. “Vulnerabilities are being discovered at an alarming rate and exploited at a scale that we’ve never seen. So I think doing the fundamentals well is more important today than it’s ever been.”
Auto-fetched and translated by AI Atlas. All rights belong to the original author.